[Tutorial] Como usar la aplicación dePKG de GeoHot en Linux

AzagraMac por mi parte opino que todos los usuarios que estamos leyendo el tema y como ya se ve has demostrado en este post, bien es de agradecerte la currada que estas haciendo y eso al menos ami me hace feliz [sonrisa]
joer macho, muchisimas gracias, de verdad, y eso que no eh echo mucho, y lo que echo lo he compartido con vosotros, que al igual que a mi, nos interesa saber como funciona, yo sigo hay..... jejeje, aunque ahora con lo de PSP.. estoy al tanto para ver algo, pero quiero ver algo pronto la verdad, me gustaria sobretodo desemcriptar el 3.55, prinpalmente es el que tengo puesto a la mia, y por ser el mas actualizado.

Yo "creo" que a este ritmo... antes de reyes tenemos algo. [ginyo]
AzagraMac escribió:joer macho, muchisimas gracias, de verdad, y eso que no eh echo mucho, y lo que echo lo he compartido con vosotros, que al igual que a mi, nos interesa saber como funciona, yo sigo hay..... jejeje, aunque ahora con lo de PSP.. estoy al tanto para ver algo, pero quiero ver algo pronto la verdad, me gustaria sobretodo desemcriptar el 3.55, prinpalmente es el que tengo puesto a la mia, y por ser el mas actualizado.

Yo "creo" que a este ritmo... antes de reyes tenemos algo. [ginyo]


Antes de reyes no, hoy mismo !!! jajajaja
Bueno, he echo muchas pruebas con las claves que ha publicado Mathieulh, para poder desemcriptar el "ps1_emu.self" del Firmware 3.55, y nada.. en todas me da error de violacion de segmento.

Unos datos:
metadataInfo:
  unknown00: 2E 4E 3D F6 00 00 00 00 B2 87 D2 29 14 7F 00 00 00 00 00 00 00 00 00 00 30 70 F1 29 14 7F 00 00
  key:       CB 11 A8 AD F5 0D 28 BB CB E1 DC DA FF EB 42 8B 44 BC D8 8A 15 06 26 D9 04 F6 27 B2 2D 55 09 9F
  ivec:      B2 0F 39 E8 B3 4C 74 B2 8A 87 75 8B 57 DC 68 A9 66 06 95 62 F8 9B B2 54 FE E1 77 52 FA 9B F2 C2

metadataHeader:
  unknown00    = 6b2f191f
  size         = 97d036f3
  unknown02    = 905e3725
  sectionCount = fbdd660
  KeyCount     = 22ebabfe
  unknown05    = 885404d2
  unknown06    = d5baa1b4
  unknown07    = 5c58b512
Violación de segmento


y aqui esta el mismo archivo desemcriptado pero del Firm 3.15
metadataInfo:
  unknown00: 2E 4E 3D F6 00 00 00 00 B2 A7 8B F6 D7 7F 00 00 00 00 00 00 00 00 00 00 30 90 AA F6 D7 7F 00 00
  key:       EA A3 AB 09 49 34 BC AB 2D A3 2C 8B BB 16 4A F4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ivec:      C6 BB A7 9F FC 6A 16 9F 28 0C 31 99 FC 7D 3F 3E 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

metadataHeader:
  unknown00    = 0
  size         = 8a0
  unknown02    = 1
  sectionCount = 6
  KeyCount     = 2e
  unknown05    = 30
  unknown06    = 0
  unknown07    = 0

metadataSectionHeaders[00]
  dataOffset    = 900
  dataSize      = A028F
  unknown02     = 2
  programIndex  = 0
  unknown04     = 2
  sha1Index     = 0
  keyIndex      = 6
  ivecIndex     = 7
  unknown09     = 2

metadataSectionHeaders[01]
  dataOffset    = A88A0
  dataSize      = 2AB18
  unknown02     = 2
  programIndex  = 1
  unknown04     = 2
  sha1Index     = 8
  keyIndex      = E
  ivecIndex     = F
  unknown09     = 2

metadataSectionHeaders[02]
  dataOffset    = D33C0
  dataSize      = 0
  unknown02     = 2
  programIndex  = 2
  unknown04     = 2
  sha1Index     = 10
  keyIndex      = 16
  ivecIndex     = 17
  unknown09     = 1

metadataSectionHeaders[03]
  dataOffset    = D33C0
  dataSize      = 0
  unknown02     = 2
  programIndex  = 3
  unknown04     = 2
  sha1Index     = 18
  keyIndex      = 1E
  ivecIndex     = 1F
  unknown09     = 1

metadataSectionHeaders[04]
  dataOffset    = D33C0
  dataSize      = 0
  unknown02     = 2
  programIndex  = 4
  unknown04     = 2
  sha1Index     = 20
  keyIndex      = 26
  ivecIndex     = 27
  unknown09     = 1

metadataSectionHeaders[05]
  dataOffset    = D56C0
  dataSize      = 780
  unknown02     = 1
  programIndex  = 3
  unknown04     = 2
  sha1Index     = 28
  keyIndex      = FFFFFFFF
  ivecIndex     = FFFFFFFF
  unknown09     = 1

metadataKeys[00]: 6D 82 A7 5F AB BE B1 B1 8A 28 14 40 67 BD 69 93
metadataKeys[01]: D6 C7 85 D0 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[02]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[03]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[04]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[05]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80
metadataKeys[06]: 21 FE 6E 44 97 DC 52 B2 D0 68 A6 A5 E0 D8 B3 69
metadataKeys[07]: A2 78 C8 B4 91 5A 19 92 35 00 32 3A 51 54 37 CE
metadataKeys[08]: 23 EA C9 2B 91 45 48 26 E2 D3 34 C1 F8 DC C6 94
metadataKeys[09]: D1 02 10 CD 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[0A]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[0B]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[0C]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[0D]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80
metadataKeys[0E]: 21 FE 6E 44 97 DC 52 B2 D0 68 A6 A5 E0 D8 B3 69
metadataKeys[0F]: A2 78 C8 B4 91 5A 19 92 35 00 32 3A 51 54 37 CE
metadataKeys[10]: 48 FA 95 FA 49 F8 F5 67 4B EC 0D 61 4E 17 D4 64
metadataKeys[11]: AF F3 A5 9C 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[12]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[13]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[14]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[15]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80
metadataKeys[16]: 21 FE 6E 44 97 DC 52 B2 D0 68 A6 A5 E0 D8 B3 69
metadataKeys[17]: A2 78 C8 B4 91 5A 19 92 35 00 32 3A 51 54 37 CE
metadataKeys[18]: 48 FA 95 FA 49 F8 F5 67 4B EC 0D 61 4E 17 D4 64
metadataKeys[19]: AF F3 A5 9C 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[1A]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[1B]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[1C]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[1D]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80
metadataKeys[1E]: 21 FE 6E 44 97 DC 52 B2 D0 68 A6 A5 E0 D8 B3 69
metadataKeys[1F]: A2 78 C8 B4 91 5A 19 92 35 00 32 3A 51 54 37 CE
metadataKeys[20]: 48 FA 95 FA 49 F8 F5 67 4B EC 0D 61 4E 17 D4 64
metadataKeys[21]: AF F3 A5 9C 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[22]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[23]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[24]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[25]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80
metadataKeys[26]: 21 FE 6E 44 97 DC 52 B2 D0 68 A6 A5 E0 D8 B3 69
metadataKeys[27]: A2 78 C8 B4 91 5A 19 92 35 00 32 3A 51 54 37 CE
metadataKeys[28]: BA C0 46 86 AB 75 C3 43 A0 AF A2 D1 E8 7D 37 2F
metadataKeys[29]: D1 BC 89 3C 00 00 00 00 00 00 00 00 00 00 00 00
metadataKeys[2A]: B6 42 E6 75 E8 52 A0 6C BD B8 ED 47 FB 09 D6 3B
metadataKeys[2B]: 3D A1 EB E2 FB 1B 8C 6C FA F1 DA 58 A5 0F 8B 1D
metadataKeys[2C]: 2E CA DE 84 16 B3 0A 85 1D 31 1C 0B 75 80 AC DB
metadataKeys[2D]: 75 F7 82 A4 3B 25 1F 6D D5 DA 9E BC 45 AB E5 80

SECTIONS:
SECTION 01: 200 ==> 200 (2C)
SECTION 02: 230 ==> 230 (1467F8)
SECTION 03: 146A28 ==> 146A28 (24)
SECTION 04: 146A4C ==> 146A4C (B00)
SECTION 05: 14754C ==> 14754C (1244)
SECTION 06: 148790 ==> 148790 (168)
SECTION 07: 1488F8 ==> 1488F8 (90)
SECTION 08: 148988 ==> 148988 (160)
SECTION 09: 148AE8 ==> 148AE8 (4)
SECTION 0A: 148AEC ==> 148AEC (4)
SECTION 0B: 148AF0 ==> 148AF0 (4)
SECTION 0C: 148AF4 ==> 148AF4 (160)
SECTION 0D: 148C54 ==> 148C54 (4)
SECTION 0E: 148C60 ==> 148C60 (1F658)
SECTION 0F: 1682B8 ==> 1682B8 (40)
SECTION 10: 170000 ==> 170000 (14)
SECTION 11: 170014 ==> 170014 (14)
SECTION 12: 170028 ==> 170028 (4)
SECTION 13: 170030 ==> 170030 (4B38)
SECTION 14: 174B68 ==> 174B68 (160)
SECTION 15: 174CC8 ==> 174CC8 (6D18)
SECTION 16: 17B9E0 ==> 17B9E0 (25D8)
SECTION 17: 17DFB8 ==> 17DFB8 (84)
SECTION 18: 17DFB8 ==> 17DFB8 (114E04)
SECTION 19: 292E00 ==> 292E00 (F680)
SECTION 1A: 2A2480 ==> 2A2480 (C380)
SECTION 1B: 2AE800 ==> 2AE800 (1763780)
SECTION 1C: 2AE800 ==> 2AE800 (21BE)
SECTION 1D: 2B09BE ==> 2B09BE (142)


Codigo Fuente del Programa:
#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>

#include <openssl/aes.h>

#include <zlib.h>

#include <elf.h>
#include "self.h"

#include <byteswap.h>

#ifdef __BIG_ENDIAN__
#define fix16(value) value
#define fix32(value) value
#define fix64(value) (uint64_t)value
#else
#define fix16(value) bswap_16(value)
#define fix32(value) bswap_32(value)
#define fix64(value) (uint64_t)bswap_64(value)
#endif

// Provide your own keys.
uint8_t erk[] = { 0xF9, 0xED, 0xD0, 0x30, 0x1F, 0x77, 0x0F, 0xAB, 0xBA, 0x88, 0x63, 0xD9, 0x89, 0x7F, 0x0F, 0xEA, 0x65, 0x51, 0xB0, 0x94, 0x31, 0xF6, 0x13, 0x12, 0x65, 0x4E, 0x28, 0xF4, 0x35, 0x33, 0xEA, 0x6B };
uint8_t riv[] = { 0xA5, 0x51, 0xCC, 0xB4, 0xA4, 0x2C, 0x37, 0xA7, 0x34, 0xA2, 0xB4, 0xF9, 0x65, 0x7D, 0x55, 0x40 };

//F9 ED D0 30 1F 77 0F AB BA 88 63 D9 89 7F 0F EA 65 51 B0 94 31 F6 13 12 65 4E 28 F4 35 33 EA 6B
//A5 51 CC B4 A4 2C 37 A7 34 A2 B4 F9 65 7D 55 40

int decompress ( uint8_t *source, int sourceSize, uint8_t *destination, int destinationSize )
{
  z_stream stream;

  stream.opaque = Z_NULL;
  stream.zalloc = Z_NULL;
  stream.zfree  = Z_NULL;

  if ( inflateInit ( &stream ) != Z_OK ) { return -1; }

  stream.next_in = source;
  stream.avail_in = sourceSize;

  stream.next_out = destination;
  stream.avail_out = destinationSize;

  int result = inflate ( &stream, Z_NO_FLUSH );

  inflateEnd ( &stream );

  return result;
}

int main ( int argc, char **argv )
{
  if ( argc != 4 )
  {
    printf ( "Usage: %s [self file] [elf file] [fix]\n", argv[0] );
    return -1;
  }

  //
  // Open the files.
  //

  FILE *selfFile = fopen ( argv[1], "r" );
  if ( selfFile == NULL ) { printf ( "ERROR: Could not open the SELF file. (%s)\n", argv[1] ); }

  FILE *elfFile = fopen ( argv[2], "w" );
  if ( elfFile == NULL ) { printf ( "ERROR: Could not open the ELF file. (%s)\n", argv[2] ); }

  //
  // Read in the self header.
  //

  SELFHEADER_t selfHeader;

  fseek ( selfFile, 0, SEEK_SET );
  fread ( &selfHeader, sizeof ( SELFHEADER_t ), 1, selfFile );

  //
  // Read in and write out the elf header.
  //

  Elf64_Ehdr elfHeader;

  fseek ( selfFile, fix64 ( selfHeader.elfHeaderOffset ), SEEK_SET );
  fread ( &elfHeader, sizeof ( Elf64_Ehdr ), 1, selfFile );

  fseek ( elfFile, 0, SEEK_SET );
  fwrite ( &elfHeader, sizeof ( Elf64_Ehdr ), 1, elfFile );

  //
  // Read in and write out the program headers.
  //

  Elf64_Phdr elfProgramHeaders[100];

  fseek ( selfFile, fix64 ( selfHeader.elfProgramHeadersOffset ), SEEK_SET );
  fread ( elfProgramHeaders, sizeof ( Elf64_Phdr ), fix16 ( elfHeader.e_phnum ), selfFile );

  fseek ( elfFile, fix64 ( elfHeader.e_phoff ), SEEK_SET );
  fwrite ( elfProgramHeaders, sizeof ( Elf64_Phdr ), fix16 ( elfHeader.e_phnum ), elfFile );

  //
  // Read in and write out the section headers.
  //

  Elf64_Shdr elfSectionHeaders[100];

  fseek ( selfFile, fix64 ( selfHeader.elfSectionHeadersOffset ), SEEK_SET );
  fread ( elfSectionHeaders, sizeof ( Elf64_Shdr ), fix16 ( elfHeader.e_shnum ), selfFile );

  fseek ( elfFile, fix64 ( elfHeader.e_shoff ), SEEK_SET );
  fwrite ( elfSectionHeaders, sizeof ( Elf64_Shdr ), fix16 ( elfHeader.e_shnum ), elfFile );

  //
  // Read in and decrypt the metadata info.
  //

  METADATAINFO_t metadataInfo;
  METADATAINFO_t metadataInfo_d;

  fseek ( selfFile, fix32 ( selfHeader.metadataInfoOffset ), SEEK_SET );
  fread ( &metadataInfo, sizeof ( METADATAINFO_t ), 1, selfFile );

  AES_KEY aesDecryptKey;

  AES_set_decrypt_key ( erk, 256, &aesDecryptKey );

  AES_cbc_encrypt ( metadataInfo.key,  metadataInfo_d.key,  32, &aesDecryptKey, riv, AES_DECRYPT );
  AES_cbc_encrypt ( metadataInfo.ivec, metadataInfo_d.ivec, 32, &aesDecryptKey, riv, AES_DECRYPT );

  printf ( "\nmetadataInfo:\n" );
  printf ( "  unknown00: "); for ( int loop = 0; loop < 32; loop++ ) { printf ( "%02X ", metadataInfo_d.unknown00[loop] ); } printf ( "\n" );
  printf ( "  key:       "); for ( int loop = 0; loop < 32; loop++ ) { printf ( "%02X ", metadataInfo_d.key[loop]       ); } printf ( "\n" );
  printf ( "  ivec:      "); for ( int loop = 0; loop < 32; loop++ ) { printf ( "%02X ", metadataInfo_d.ivec[loop]      ); } printf ( "\n" );

  //
  // Read in and decrypt the metadata header.
  //

  METADATAHEADER_t metadataHeader;
  METADATAHEADER_t metadataHeader_d;

  fread ( &metadataHeader, sizeof ( METADATAHEADER_t ), 1, selfFile );

  AES_KEY aesEncryptKey;

  AES_set_encrypt_key ( metadataInfo_d.key, 128, &aesEncryptKey );

  uint8_t ecount[AES_BLOCK_SIZE];
  uint32_t num = 0;

  AES_ctr128_encrypt ( ( uint8_t * ) &metadataHeader, ( uint8_t * ) &metadataHeader_d, sizeof ( METADATAHEADER_t ), &aesEncryptKey, metadataInfo_d.ivec, ecount, &num );

  printf ( "\nmetadataHeader:\n" );
  printf ( "  unknown00    = %x\n", fix32(metadataHeader_d.unknown00)    );
  printf ( "  size         = %x\n", fix32(metadataHeader_d.size)         );
  printf ( "  unknown02    = %x\n", fix32(metadataHeader_d.unknown02)    );
  printf ( "  sectionCount = %x\n", fix32(metadataHeader_d.sectionCount) );
  printf ( "  KeyCount     = %x\n", fix32(metadataHeader_d.keyCount)     );
  printf ( "  unknown05    = %x\n", fix32(metadataHeader_d.unknown05)    );
  printf ( "  unknown06    = %x\n", fix32(metadataHeader_d.unknown06)    );
  printf ( "  unknown07    = %x\n", fix32(metadataHeader_d.unknown07)    );

  //
  // Read in and decrypt the metadata section headers.
  //

  METADATASECTIONHEADER_t metadataSectionHeaders[100];
  METADATASECTIONHEADER_t metadataSectionHeaders_d[100];

  fread ( metadataSectionHeaders, sizeof ( METADATASECTIONHEADER_t ), fix32 ( metadataHeader_d.sectionCount ), selfFile );

  AES_ctr128_encrypt ( ( uint8_t * ) metadataSectionHeaders, ( uint8_t * ) metadataSectionHeaders_d, sizeof ( METADATASECTIONHEADER_t ) * fix32 ( metadataHeader_d.sectionCount ), &aesEncryptKey, metadataInfo_d.ivec, ecount, &num );

  for ( int loop = 0; loop < fix32 ( metadataHeader_d.sectionCount ); loop++ )
  {
    printf ( "\nmetadataSectionHeaders[%02X]\n", loop );
    printf ( "  dataOffset    = %lX\n", fix64 ( metadataSectionHeaders_d[loop].dataOffset   ) );
    printf ( "  dataSize      = %lX\n", fix64 ( metadataSectionHeaders_d[loop].dataSize     ) );
    printf ( "  unknown02     = %X\n",  fix32 ( metadataSectionHeaders_d[loop].unknown02    ) );
    printf ( "  programIndex  = %X\n",  fix32 ( metadataSectionHeaders_d[loop].programIndex ) );
    printf ( "  unknown04     = %X\n",  fix32 ( metadataSectionHeaders_d[loop].unknown04    ) );
    printf ( "  sha1Index     = %X\n",  fix32 ( metadataSectionHeaders_d[loop].sha1Index    ) );
    printf ( "  keyIndex      = %X\n",  fix32 ( metadataSectionHeaders_d[loop].keyIndex     ) );
    printf ( "  ivecIndex     = %X\n",  fix32 ( metadataSectionHeaders_d[loop].ivecIndex    ) );
    printf ( "  unknown09     = %X\n",  fix32 ( metadataSectionHeaders_d[loop].unknown09    ) );
  }

  //
  // Read in and decrypt the metadata keys.
  //

  KEY_t metadataKeys[100];
  KEY_t metadataKeys_d[100];

  fread ( metadataKeys, sizeof ( KEY_t ), fix32 ( metadataHeader_d.keyCount ), selfFile );

  AES_ctr128_encrypt ( ( uint8_t * ) metadataKeys, ( uint8_t * ) metadataKeys_d, sizeof ( KEY_t ) * fix32 ( metadataHeader_d.keyCount ), &aesEncryptKey, metadataInfo_d.ivec, ecount, &num );

  printf ( "\n" );
  for ( int loop = 0; loop < fix32 ( metadataHeader_d.keyCount ); loop++ )
  {
    printf ( "metadataKeys[%02X]: ", loop );
    for ( int poop = 0; poop < 16; poop++ ) { printf ( "%02X ", metadataKeys_d[loop][poop] ); }
    printf ( "\n" );
  }

  //
  // Write out the section data.
  //

  printf ( "\nSECTIONS: \n" );
  for ( int loop = 0; loop < fix16 ( elfHeader.e_shnum ); loop++ )
  {
    int fix = atoi ( argv[3] );

    int offset = fix64 ( elfSectionHeaders[loop].sh_offset );
    int size   = fix64 ( elfSectionHeaders[loop].sh_size   );

    if ( ( ( offset + fix ) > 0 ) && ( size > 0 ) )
    {
      uint8_t *sectionBuffer = malloc ( size );

      fseek ( selfFile, ( offset + fix ), SEEK_SET );
      fread ( sectionBuffer, size, 1, selfFile );

      fseek ( elfFile, offset, SEEK_SET );
      fwrite ( sectionBuffer, size, 1, elfFile );

      printf ( "SECTION %02X: %X ==> %X (%X)\n", loop, offset + fix, offset, size );

      free ( sectionBuffer );
    }
  }

  //
  // Read in, decrypt, decompress and write out the program data.
  //

  for ( int loop = 0; loop < fix16 ( elfHeader.e_phnum ); loop++ )
  {
    int elfOffset = fix64 ( elfProgramHeaders[loop].p_offset );
    int elfSize   = fix64 ( elfProgramHeaders[loop].p_filesz );

    if ( elfSize > 0 )
    {
      uint8_t *key  = metadataKeys_d[fix32 ( metadataSectionHeaders_d[loop].keyIndex) ];
      uint8_t *ivec = metadataKeys_d[fix32 ( metadataSectionHeaders_d[loop].ivecIndex )];

      int selfOffset = fix64 ( metadataSectionHeaders_d[loop].dataOffset   );
      int selfSize   = fix64 ( metadataSectionHeaders_d[loop].dataSize     );
      selfSize = ( selfSize + 15 ) & 0xFFFFFFF0;

      uint8_t *selfBuffer = malloc ( selfSize );
      uint8_t *selfBuffer_d = malloc ( selfSize );

      fseek ( selfFile, selfOffset, SEEK_SET );
      fread ( selfBuffer, selfSize, 1, selfFile );

      AES_set_encrypt_key ( key, 128, &aesEncryptKey );

      AES_ctr128_encrypt ( selfBuffer, selfBuffer_d, selfSize, &aesEncryptKey, ivec, ecount, &num );

      uint8_t *elfBuffer = malloc ( elfSize );

      decompress ( selfBuffer_d, selfSize, elfBuffer, elfSize );

      fseek ( elfFile, elfOffset, SEEK_SET );
      fwrite ( elfBuffer, elfSize, 1, elfFile );

      free ( elfBuffer );

      free ( selfBuffer );
      free ( selfBuffer_d );
    }
  }

  //
  // Close the files.
  //

  fclose ( elfFile );

  fclose ( selfFile );

  return 0;
}


Y aqui el MD5 del .self del 3.55
87a6f1845e7b623627448db09e1db413


del 3.15
0cac7feeea410fcf0316447ce90a4818


A seguir buscando...

saludos [oki]


EDITO:
SELF header
  elf #1 offset:  00000000_00000090
  header len:     00000000_00000900
  meta offset:    00000000_000003f0
  phdr offset:    00000000_00000040
  shdr offset:    00000000_000d5370
  file size:      00000000_002b1a00
  auth id:        10700000_41000001 (Unknown)
  vendor id:      01000002
  info offset:    00000000_00000070
  sinfo offset:   00000000_00000290
  version offset: 00000000_00000390
  control info:   00000000_000003a0 (00000000_00000070 bytes)
  app version:    3.55.0
  SDK type:       unknown
  app type:       application

Control info
  control flags:
     40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  file digest:
     72 dc 2c 10 7f 27 aa da 41 9e d4 91 c1 9e 9a cd 5d 42 1f eb

Section header
    offset             size              compressed unk1     unk2     encrypted
    00000000_00000900  00000000_000a0448 [YES]      00000000 00000000 [YES]
    00000000_000a8300  00000000_0002adf9 [YES]      00000000 00000000 [YES]
    00000000_000d3100  00000000_00000000 [NO ]      00000000 00000000 [YES]
    00000000_000d3100  00000000_00000000 [NO ]      00000000 00000000 [YES]
    00000000_000d3100  00000000_00000000 [NO ]      00000000 00000000 [YES]
    00000000_00000000  00000000_00000000 [NO ]      00000000 00000000 [N/A]
    00000000_00000000  00000000_00000000 [NO ]      00000000 00000000 [N/A]
    00000000_00000000  00000000_00000040 [NO ]      00000000 00000000 [N/A]

Encrypted Metadata
  unable to decrypt metadata

ELF header
  type:                                 Executable file
  machine:                              PowerPC64
  version:                              1
  phdr offset:                          00000000_00000040
  shdr offset:                          00000000_002b1280
  entry:                                00000000_00184d88
  flags:                                00000000
  header size:                          00000040
  program header size:                  00000038
  program headers:                      8
  section header size:                  00000040
  section headers:                      30
  section header string table index:    29

Program headers
    type  offset            vaddr             paddr
          memsize           filesize          PPU  SPE  RSX  align
     LOAD 00000000_00000000 00000000_00010000 00000000_00010000
          00000000_00168a48 00000000_00168a48 r-x  r--  ---  00000000_00010000
     LOAD 00000000_00170000 00000000_00180000 00000000_00180000
          00000000_018a2780 00000000_0013ef80 rw-  rw-  ---  00000000_00010000
     LOAD 00000000_002aef80 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 r--  ---  ---  00000000_00010000
     LOAD 00000000_002aef80 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 rw-  ---  ---  00000000_00010000
     LOAD 00000000_002aef80 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 rw-  rw-  rw-  00000000_00010000
    ????? 00000000_0017e090 00000000_0018e090 00000000_0018e090
          00000000_00000084 00000000_00000000 r--  ---  ---  00000000_00000004
    ????? 00000000_00000000 00000000_00000000 00000000_00000000
          00000000_00000000 00000000_00000000 ---  ---  ---  00000000_00000008
    ????? 00000000_00168a08 00000000_00178a08 00000000_00178a08
          00000000_00000040 00000000_00000040 ---  ---  ---  00000000_00000004

Section headers
  [Nr] Name            Type      Addr              ES Flg Lk Inf Al
       Off                       Size
  [00] <no-name>       NULL      00000000_00000000 00     00 000 00
       00000000_00000000         00000000_00000000
  [01] <no-name>       PROGBITS  00000000_00010200 00 wa  00 000 04
       00000000_00000200         00000000_0000002c
  [02] <no-name>       PROGBITS  00000000_00010230 00 wa  00 000 08
       00000000_00000230         00000000_00146eb8
  [03] <no-name>       PROGBITS  00000000_001570e8 00 wa  00 000 04
       00000000_001470e8         00000000_00000024
  [04] <no-name>       PROGBITS  00000000_0015710c 00 wa  00 000 04
       00000000_0014710c         00000000_00000b00
  [05] <no-name>       PROGBITS  00000000_00157c0c 00  a  00 000 04
       00000000_00147c0c         00000000_00001244
  [06] <no-name>       PROGBITS  00000000_00158e50 00  a  00 000 08
       00000000_00148e50         00000000_00000168
  [07] <no-name>       PROGBITS  00000000_00158fb8 00  a  00 000 04
       00000000_00148fb8         00000000_00000090
  [08] <no-name>       PROGBITS  00000000_00159048 00  a  00 000 04
       00000000_00149048         00000000_00000160
  [09] <no-name>       PROGBITS  00000000_001591a8 00  a  00 000 04
       00000000_001491a8         00000000_00000004
  [10] <no-name>       PROGBITS  00000000_001591ac 00  a  00 000 04
       00000000_001491ac         00000000_00000004
  [11] <no-name>       PROGBITS  00000000_001591b0 00  a  00 000 04
       00000000_001491b0         00000000_00000004
  [12] <no-name>       PROGBITS  00000000_001591b4 00  a  00 000 04
       00000000_001491b4         00000000_00000160
  [13] <no-name>       PROGBITS  00000000_00159314 00  a  00 000 04
       00000000_00149314         00000000_00000004
  [14] <no-name>       PROGBITS  00000000_00159320 00  a  00 000 16
       00000000_00149320         00000000_0001f6e8
  [15] <no-name>       PROGBITS  00000000_00178a08 00  a  00 000 04
       00000000_00168a08         00000000_00000040
  [16] <no-name>       PROGBITS  00000000_00180000 00  ae 00 000 04
       00000000_00170000         00000000_00000014
  [17] <no-name>       PROGBITS  00000000_00180014 00  ae 00 000 04
       00000000_00170014         00000000_00000014
  [18] <no-name>       PROGBITS  00000000_00180028 00  ae 00 000 04
       00000000_00170028         00000000_00000004
  [19] <no-name>       PROGBITS  00000000_00180030 00  ae 00 000 08
       00000000_00170030         00000000_00004be8
  [20] <no-name>       PROGBITS  00000000_00184c18 00  ae 00 000 04
       00000000_00174c18         00000000_00000160
  [21] <no-name>       PROGBITS  00000000_00184d78 00  ae 00 000 04
       00000000_00174d78         00000000_00006d40
  [22] <no-name>       PROGBITS  00000000_0018bab8 04  ae 00 000 08
       00000000_0017bab8         00000000_000025d8
  [23] <no-name>       NOBITS    00000000_0018e090 00  ae 00 000 04
       00000000_0017e090         00000000_00000084
  [24] <no-name>       PROGBITS  00000000_0018e090 00  ae 00 000 08
       00000000_0017e090         00000000_00115474
  [25] <no-name>       PROGBITS  00000000_002a3580 00  ae 00 000 128
       00000000_00293580         00000000_0000f680
  [26] <no-name>       PROGBITS  00000000_002b2c00 00  ae 00 000 128
       00000000_002a2c00         00000000_0000c380
  [27] <no-name>       NOBITS    00000000_002bf000 00  ae 00 000 256
       00000000_002aef80         00000000_01763780
  [28] <no-name>       PROGBITS  00000000_00000000 00     00 000 01
       00000000_002aef80         00000000_000021be
  [29] <no-name>       STRTAB    00000000_00000000 00     00 000 01
       00000000_002b113e         00000000_00000142
53 respuestas
1, 2